CVE-2026-72300

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: topology: validate vendor array size before parsing

sof_parse_token_sets() reads array->size while iterating over topology

private data. The loop condition only checks that some data remains, so a

malformed topology with a truncated trailing vendor array can make the

parser read the size field before a full vendor-array header is available.

Validate that the remaining private data contains a complete

snd_soc_tplg_vendor_array header before reading array->size.

The declared array size check also needs to remain signed. asize is an int,

but sizeof(*array) has type size_t, so comparing them directly promotes

negative asize values to unsigned and lets them pass the check,

as reported in the stable review thread reference below.

Cast sizeof(*array) to int when validating the declared array size. This

rejects negative, zero and otherwise too-small sizes before the parser

dispatches to the tuple-specific code.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References